Glossary
Segregation of Duties
Control that separates responsibilities so that the rights to create, change, review, and approve data and to administer the system are not inappropriately concentrated in one person.
Details
Segregation of duties reduces the conflict of interest in which a user can change their own results, privileges, or audit trail without independent oversight. Inspections cite analysts holding administrator rights, or a structure in which the same person creates and deletes users and approves data. Check the role and privilege matrix, the justification for administrator assignments, independent review, use of emergency privileges, and periodic privilege review.
